Extracted

• • Target
    7a288efca7dafe8432889bf7f245189d937b8bad7513dd015787dc91df80e4ca
  • Size 45KB
  • SHA256 7a288efca7dafe8432889bf7f245189d937b8bad7513dd015787dc91df80e4ca
  • MD5 d1ed9a60d03690eac2c31316d79de6ad
  • SHA1 11d816a70684bae547b4973b2bac1858fa7a8c40
  • SHA512 4e4007942013e856645183ef602c7ea75eba5846bdbb742a6121c79718c6bd5b73ef944c84c692315f40bf809da3d2f6628264a8422d4325c922415bae49b7f8
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFQ3Fo9EaOPIizjbbgX3iD4mu4ijHlBDZbx:4uLZZTUTn2B8Ea3i3bkXS0m+rdbx
  • TLSH
    T156231A003BE8822BF2BE4F78A9F26145457EF6B37603D54A1CC441DB5713BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2